AZ-305 Practice Exam 60 — 20 Questions

Question 1

You are designing a governance strategy for a new Azure subscription. The security team requires that all resources must have a 'CostCenter' tag and an 'Environment' tag. Which Azure policy effect should you use to automatically apply the tags to new resources?

Accepted Answer

modify. The 'modify' effect is correct because it can automatically append or replace missing tags on new or existing non-compliant resources during resource creation or update. Unlike 'deployIfNotExists', which only runs remediation tasks after creation, 'modify' applies the tags inline as part of the resource creation request, ensuring compliance without requiring a separate remediation task.

Answer

audit

Answer

deny

Answer

deployIfNotExists

Question 2

Refer to the exhibit. You deploy this ARM template to create an Azure Monitor Workbook. The template deploys successfully. What will the workbook display?

Accepted Answer

CPU utilization averaged over 5-minute intervals.. The ARM template configures an Azure Monitor Workbook to query the `InsightsMetrics` table for the `cpu_usage_percentage` metric, which is collected by Azure Monitor Agent (AMA) at a default granularity of 1 minute. The workbook uses the `avg` aggregation and a time grain of `5m` (5 minutes) in the query, so it displays CPU utilization averaged over 5-minute intervals. The `summarize` operator with `bin(TimeGenerated, 5m)` explicitly groups data into 5-minute buckets, making option B correct.

Answer

CPU utilization averaged over 1-hour intervals.

Answer

Memory utilization over time.

Answer

Disk I/O utilization over time.

Question 3

Refer to the exhibit. You are an Azure administrator for a company that enforces a policy that no virtual networks or network security groups can be created. However, a developer reports that they successfully created a virtual network. What is the most likely reason the policy did not block the creation?

Accepted Answer

The policy was assigned to a scope that does not include the subscription or resource group where the virtual network was created.. Option C is correct because Azure Policy assignments are scoped to a specific management group, subscription, or resource group. If the policy was assigned to a scope that does not include the subscription or resource group where the developer created the virtual network, the policy would not apply, and the creation would succeed. The policy definition itself may be valid, but without proper assignment scope, it cannot enforce the deny effect.

Answer

The policy definition contains a syntax error.

Answer

The policy only applies to network security groups, not virtual networks.

Answer

The policy effect should be 'append' instead of 'deny'.

Question 4

You need to configure a monitoring solution for Azure virtual machines that collects performance counters, event logs, and enables alerting based on CPU usage exceeding 90%. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a unified platform for collecting performance counters and event logs from Azure VMs via the Log Analytics agent or Azure Monitor Agent, and it supports metric-based alert rules that can trigger when CPU usage exceeds a defined threshold (e.g., 90%). This directly meets the requirements for monitoring, log collection, and alerting without additional services.

Answer

Azure Policy

Answer

Microsoft Sentinel

Answer

Azure Update Manager

Question 5

Refer to the exhibit. You are reviewing an Azure Resource Manager deployment configuration. The deployment is failing with a conflict error. What is the most likely cause?

Accepted Answer

The debugSetting includes requestContent, which may cause the request to exceed size limits. The correct answer is C because including `requestContent` in the `debugSetting` property of an ARM template deployment causes the entire HTTP request payload to be logged. For large templates or parameter files, this can exceed the Azure Resource Manager API request size limit (typically 4 MB), resulting in a conflict error (HTTP 409) as the service rejects the oversized request.

Answer

The deployment mode is Incremental instead of Complete

Answer

The template is not parameterized

Answer

The onError property is set to DeploymentRollback

Question 6

Which TWO actions should you take to implement a least-privilege identity strategy for Azure resources?

Accepted Answer

Use managed identities for Azure resources instead of service principals. Option D is correct because managed identities for Azure resources eliminate the need to store and manage credentials. Azure automatically rotates the identity's principal in Azure AD, and the resource can obtain an access token directly from the Azure Instance Metadata Service (IMDS) endpoint without any secrets. This aligns with the least-privilege principle by removing static, long-lived credentials and reducing the attack surface.

Answer

Assign Global Administrator role to all cloud architects

Answer

Store service principal passwords in Azure Key Vault and retrieve at runtime

Answer

Enable self-service password reset for all users

Question 7

You are designing a monitoring solution for a hybrid environment with on-premises servers and Azure VMs. You need to collect performance data from all servers and visualize it in a single dashboard. Which Azure service should you use?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a unified platform for collecting, analyzing, and visualizing performance data from both on-premises servers and Azure VMs. By deploying the Azure Monitor agent on all servers, you can send metrics and logs to a single Log Analytics workspace and then use Azure Workbooks or Metrics Explorer to create a consolidated dashboard.

Answer

Azure Service Health

Answer

Azure Workbooks

Answer

Azure Arc

Question 8

You are tasked with ensuring that all VMs in the subscription have Azure Hybrid Benefit enabled for Windows Server. You create the Azure Policy shown in the exhibit. However, after assignment, the compliance report shows that some D-series VMs are still non-compliant. What is the most likely cause?

Accepted Answer

The policy does not apply to existing resources; it only blocks new or updated ones.. Azure Policy with the 'deny' effect only blocks new or updated resources that violate the policy; it does not automatically remediate existing non-compliant resources. The D-series VMs were likely created before the policy was assigned, so they remain non-compliant until they are redeployed or a remediation task is triggered. To enforce compliance on existing resources, you would need to use a 'deployIfNotExists' or 'modify' effect with a remediation task.

Answer

The 'deny' effect is incorrectly configured; it should be 'audit' to show compliance.

Answer

The 'like' operator does not match standard D-series SKUs.

Answer

The policy is scoped to a management group that excludes the resource group containing the VMs.

Question 9

Your organization has multiple Azure subscriptions and uses Azure Blueprints to enforce governance. You need to design a blueprint that includes role assignments, policy assignments, and resource groups. Which THREE components can be included in an Azure Blueprint? (Choose three.)

Accepted Answer

Role assignments. Azure Blueprints allow you to define a repeatable set of Azure resources that adhere to your organization's standards, patterns, and requirements. Role assignments (B) are a core artifact that can be included to grant specific Azure RBAC roles at the blueprint scope, ensuring consistent access control. Policy assignments (C) are also a native blueprint artifact, enabling you to enforce compliance rules across the environment. ARM templates (E) can be included as an artifact to deploy infrastructure as code, making them a valid component of a blueprint definition.

Answer

Management group

Answer

Subscription

Question 10

A company needs to design a data storage solution for a global SaaS application that requires multi-region writes with conflict resolution. The data model includes both structured and unstructured data. Which THREE Azure data services should they consider?

Accepted Answer

Azure Blob Storage. Azure Blob Storage is correct because it provides globally scalable, object-based storage for unstructured data (such as images, videos, and documents) that can be accessed from anywhere via HTTP/HTTPS. It supports geo-redundant storage options (e.g., GRS, RA-GRS) and can be integrated with Azure Front Door or Traffic Manager to enable multi-region read access, though it does not natively handle multi-region writes with conflict resolution—this is why it is paired with Cosmos DB for structured data.

Answer

Azure Cache for Redis

Answer

Azure Table Storage

Question 11

You are designing an identity lifecycle management solution for a multinational company. Employees frequently change departments, and you need to automate the assignment and removal of application access based on their current department. Which THREE Microsoft Entra features should you use?

Accepted Answer

Dynamic membership groups. Dynamic membership groups (A) are correct because they automatically add or remove users based on attribute values like 'department'. When an employee changes departments, their department attribute is updated, and the group membership is recalculated, granting or revoking access to applications assigned to that group. This is the core mechanism for automating access changes based on user attributes.

Answer

Microsoft Entra Privileged Identity Management

Answer

Microsoft Entra self-service password reset

Question 12

A company is designing a disaster recovery strategy for a mission-critical Azure SQL Database. They require a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of 1 hour. Which replication option should they use?

Accepted Answer

Failover groups with active geo-replication. Failover groups with active geo-replication provide the lowest RPO (typically 5 seconds or less) and RTO (under 1 hour) for Azure SQL Database. Active geo-replication asynchronously replicates transactions to a secondary region, and failover groups orchestrate a coordinated, application-transparent failover that meets the stringent RTO requirement.

Answer

Zone-redundant deployment

Answer

Auto-failover groups with active geo-replication

Answer

Geo-restore

Question 13

Your company is designing a monitoring solution for a critical line-of-business application running on multiple Azure VMs. The application emits custom performance counters. You need to ingest these counters into Azure Monitor Metrics and create a metric alert when the average value exceeds a threshold over 5 minutes. The solution must minimize latency between counter emission and alert firing. What should you use?

Accepted Answer

Azure Monitor agent to collect counters and send to Azure Monitor Metrics, then create a metric alert.. The Azure Monitor agent is the correct choice because it can collect custom performance counters and send them directly to Azure Monitor Metrics, which supports near-real-time metric alerts with low latency. This minimizes the delay between counter emission and alert firing, meeting the requirement for a 5-minute evaluation window.

Answer

Application Insights agent to collect counters and send to Application Insights, then create a metric alert.

Answer

Log Analytics agent to collect counters and send to a Log Analytics workspace, then create a log alert.

Answer

Azure Diagnostics extension to collect counters and send to Azure Storage, then use Azure Monitor Metrics from storage.

Question 14

You are designing a monitoring solution for a multi-region application deployed on Azure Virtual Machines and Azure SQL Database. The solution must provide a unified view of metrics and logs from all resources, detect anomalies using machine learning, and send alerts to the operations team. Which TWO capabilities should you include in the design?

Accepted Answer

Azure Application Insights. Azure Monitor is the core platform for collecting, analyzing, and acting on telemetry from Azure resources, including metrics and logs from VMs and SQL Database. Application Insights extends Azure Monitor with application performance management (APM) and built-in machine learning anomaly detection (e.g., Smart Detection) for proactive alerting. Together, they provide a unified monitoring view with ML-driven insights.

Answer

Azure Service Health

Answer

Azure Security Center

Answer

Azure Log Analytics

Question 15

Refer to the exhibit. An Azure SQL Database is deployed in a VNet with a private endpoint at IP 10.0.1.4. The network security group rule shown is applied to the subnet of the private endpoint. A developer reports that they cannot connect to the database from a VM in the same VNet. What is the most likely cause?

Accepted Answer

The rule is being blocked by a higher priority deny rule.. The exhibit shows a valid inbound NSG rule allowing TCP traffic from VirtualNetwork to the private endpoint IP. However, if a higher-priority deny rule exists (e.g., denying all traffic from VirtualNetwork or a specific source), it will override this allow rule. Since the developer cannot connect from a VM in the same VNet, the most likely cause is a conflicting deny rule with a lower priority number (higher priority) blocking the traffic.

Answer

The source address prefix is set to VirtualNetwork, which is incorrect.

Answer

The protocol should be UDP instead of TCP.

Answer

The rule is applied to the wrong direction (outbound instead of inbound).

Question 16

A multinational corporation needs to store and analyze petabytes of historical data for regulatory reporting. The data is rarely accessed but must be available for queries within 5 minutes. Which Azure storage solution should they choose to minimize cost?

Accepted Answer

Azure Data Lake Storage Gen2. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct choice because it combines a hierarchical namespace with Azure Blob Storage's massive scalability, enabling petabyte-scale storage at low cost. It supports fast queries via tools like Azure Synapse or PolyBase, meeting the 5-minute query SLA for cold data, while its tiered storage (e.g., Cool or Archive access tiers) minimizes cost for rarely accessed historical data.

Answer

Azure SQL Database

Answer

Azure Files

Answer

Azure Cosmos DB

Question 17

A company wants to analyze IoT sensor data from millions of devices in near real-time and store the raw data for batch processing. Which combination of Azure services should they use?

Accepted Answer

Azure Event Hubs and Azure Blob Storage. Azure Event Hubs is a highly scalable data streaming platform and event ingestion service capable of ingesting millions of events per second from IoT devices in near real-time. Azure Blob Storage provides cost-effective, durable object storage for the raw data, which can then be used for batch processing with services like Azure Data Lake Analytics or Azure Synapse. This combination directly meets the requirements for near real-time ingestion and raw data storage for batch processing.

Answer

Azure Event Hubs and Azure Synapse Analytics

Answer

Azure IoT Hub and Azure Cosmos DB

Answer

Azure Data Lake Storage and Azure Stream Analytics

Question 18

You are designing a storage solution for a globally distributed application that requires low-latency read access from multiple regions. Which Azure storage solution should you recommend?

Accepted Answer

Azure Cosmos DB with multi-region writes and multiple read regions. Azure Cosmos DB with multi-region writes and multiple read regions is the correct choice because it provides turnkey global distribution with single-digit-millisecond latency for reads and writes from any Azure region. This solution directly addresses the requirement for low-latency read access from multiple regions, as Cosmos DB automatically replicates data to all configured regions and offers multiple consistency models to balance performance and data freshness.

Answer

Azure Blob Storage with read-access geo-redundant storage (RA-GRS)

Answer

Azure SQL Database with active geo-replication

Answer

Azure Files with Azure File Sync

Question 19

Which TWO of the following are benefits of using Azure Cosmos DB for a globally distributed application?

Accepted Answer

Multiple well-defined consistency levels. Azure Cosmos DB offers multiple well-defined consistency levels (Strong, Bounded Staleness, Session, Consistent Prefix, Eventual) that allow developers to balance data consistency, availability, and latency according to application requirements. This flexibility is a key benefit for globally distributed applications because different operations may tolerate different levels of staleness while still meeting SLAs.

Answer

Full support for SQL Server features like stored procedures

Answer

Automatic failover to a secondary region without manual intervention

Answer

Support for only the SQL API

Question 20

You are designing a data storage solution for a healthcare application that stores patient records. The solution must meet compliance requirements that data in the US must be stored in US regions, and data in the EU must be stored in EU regions. Additionally, the solution must support global queries with low latency. What should you use?

Accepted Answer

Azure Cosmos DB with multi-region writes and conflict resolution policy based on region. Azure Cosmos DB with multi-region writes is the correct choice because it provides active-active replication across multiple regions, enabling low-latency global queries by allowing writes and reads from any region. The conflict resolution policy based on region ensures that data sovereignty requirements are met by prioritizing writes from the region where the data originates (e.g., US writes win in US regions, EU writes win in EU regions), which aligns with the compliance requirement that data must stay within its respective geographic boundary.

Answer

Azure Blob Storage with RA-GRS storage accounts in each region

Answer

Azure SQL Database with active geo-replication and a failover policy

Answer

Azure SQL Managed Instance with failover groups